Zploit 0-Day Shell

:: Editing File: request_pay.php

<?php
include 'db.php';
include 'accessToken.php';
date_default_timezone_set("Asia/Kolkata");

// Validate token
if (empty($_GET['token'])) {
    die("Invalid Payment Link.");
}

$token = mysqli_real_escape_string($conn, $_GET['token']);

// Fetch payment link details
$sql = "SELECT pr.*, u.first_name, u.last_name, s.plan_name, s.new_price 
        FROM payment_link_details pr
        LEFT JOIN user_details u ON pr.re_user_id = u.user_id
        LEFT JOIN sub_plans s ON pr.plan_id = s.plan_id
        WHERE pr.payment_link_share_id = '$token'";
$result = mysqli_query($conn, $sql);

if (mysqli_num_rows($result) == 0) {
    die("Payment link expired or invalid.");
}

$data = mysqli_fetch_assoc($result);

if ($data['status'] == "Completed") {
    die("This payment request is already completed.");
}

$morderid   = uniqid("ord_"); 
$amount     = $data['new_price'] * 100; // in paisa
$employeeId = $data['employee_id'];
$plan_id    = $data['plan_id'];
$user_id    = $data['re_user_id'];
$start_date = date('Y-m-d');
$end_date   = date('Y-m-d', strtotime('+1 month'));

// ===== PhonePe API Call =====
$curl = curl_init();
curl_setopt_array($curl, array(
  CURLOPT_URL => 'https://api.phonepe.com/apis/pg/checkout/v2/pay',
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_CUSTOMREQUEST => 'POST',
  CURLOPT_POSTFIELDS =>'{
    "merchantOrderId": "'.$morderid.'",
    "amount":"'.$amount.'",
    "expireAfter": 1200,
    "metaInfo": {
           "udf1": "'.$user_id.'",
           "udf2": "'.$plan_id.'",
           "udf3": "'.$employeeId.'",
           "udf4":"'.$_GET['token'].'"
    },
    "paymentFlow": {
      "type": "PG_CHECKOUT",
      "message": "SoulmeetVivah Plan Payment",
      "paymentMode": "PROD",
      "merchantUrls": {
          "redirectUrl": "https://soulmeetvivah.com/success.php?token='.$token.'&morderid='.$morderid.'",
          "callbackUrl": "http://localhost/soulmeet-vivah/new_website/V1.2/pay-now/callbackurl.php"
      }
    }
}',
  CURLOPT_HTTPHEADER => array(
    'Content-Type: application/json',
    'Authorization: O-Bearer '.$accessToken
  ),
));

$response = curl_exec($curl);
curl_close($curl);
$getPaymentInfo = json_decode($response,true);

if(!isset($getPaymentInfo['redirectUrl'])){
    die("Error creating payment session. Try again.");
}

$orderid         = $getPaymentInfo['orderId'];
$redirectTokenurl= $getPaymentInfo['redirectUrl'];
?>
<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <title>Confirm Payment</title>
  <script src="https://mercury.phonepe.com/web/bundle/checkout.js"></script>
  <style>
    body { font-family: Arial; background:#f9f9f9; padding:30px; }
    .payment-box { max-width:450px; margin:auto; background:#fff; padding:20px; border-radius:10px; box-shadow:0 0 10px rgba(0,0,0,0.1); }
    h4 { text-align:center; margin-bottom:15px; }
    .terms { font-size:14px; margin-top:15px; height:150px; overflow-y:auto; border:1px solid #ccc; padding:10px; border-radius:8px; background:#fafafa; }
    #payButton { width:100%; padding:12px; font-size:16px; background:#28a745; color:#fff; border:none; border-radius:8px; cursor:pointer; margin-top:15px; }
    #payButton:disabled { background:#aaa; cursor:not-allowed; }
  </style>
</head>
<body>
<div class="payment-box">
  <h4>Confirm Your Payment</h4>
  <p><b>User:</b> <?= $data['first_name'].' '.$data['last_name'] ?></p>
  <p><b>Plan:</b> <?= $data['plan_name'] ?> (₹<?= $data['new_price'] ?>)</p>
  
  <h5>Terms & Conditions</h5>
  <div class="terms">
    <p><b>1. Membership Validity:</b> Your membership will remain active for the selected plan duration.</p>
    <p><b>2. Non-Refundable Policy:</b> Payments once made are non-refundable.</p>
    <p><b>3. Privacy & Security:</b> Your personal details are kept private and secure.</p>
    <p><b>4. Account Usage:</b> Each membership is for a single individual only.</p>
    <p><b>5. Renewal:</b> Renew before expiry to continue using services.</p>
  </div>
  
  <div style="margin-top:10px;">
    <input type="checkbox" id="agreeTerms"> <label for="agreeTerms">I agree to the Terms & Conditions</label>
  </div>
  
  <button id="payButton" disabled>Pay Now (₹<?= $data['new_price'] ?>)</button>
</div>

payButton.addEventListener('click', function () {
      const agreed = document.getElementById('agreeTerms').checked;
      if (!agreed) {
          alert('Please agree to the Terms & Conditions before proceeding.');
          return;
      }
      var tokenUrl = '<?= $redirectTokenurl ?>';
      function paymentCallback(response) {
          console.log(response);
          if (response === 'USER_CANCEL') {
              alert('Payment cancelled.');
              window.location.href="https://soulmeetvivah.com/fail.php";
          } else if (response === 'CONCLUDED') {
              window.location.href='https://soulmeetvivah.com/success.php?token=<?= $token ?>&orderid=<?= $orderid ?>&moid=<?= $morderid ?>';
          }
      }
      if (window.PhonePeCheckout && window.PhonePeCheckout.transact) {
          window.PhonePeCheckout.transact({
              tokenUrl: tokenUrl,
              callback: paymentCallback,
              type: 'IFRAME'
          });
      } else {
          alert('PhonePeCheckout is not available.');
      }
  });
</script>
</body>
</html>